from rest_framework import viewsets

from apps.compliance.permissions import IsOpsOrAdmin

from .models import Shipment
from .serializers import ShipmentSerializer


class ShipmentViewSet(viewsets.ModelViewSet):
    queryset = Shipment.objects.all()
    serializer_class = ShipmentSerializer
    # The buyer portal reads shipments through the ORM (apps/buyer/views.py), not
    # this API, so nothing outside ops/admin needs it — including for reads. A
    # buyer must not be able to create a shipment or rewrite the status its own
    # page displays.
    permission_classes = [IsOpsOrAdmin]